Analysis
- max time kernel
123s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 13:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-01_67c20169c8da3ab61c3e007a517926a7_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-01_67c20169c8da3ab61c3e007a517926a7_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-01_67c20169c8da3ab61c3e007a517926a7_elex_mafia.exe
- Size 520KB
- Sample261002-p89kcstcma
- SHA256 463b939a8e9c27ee9563ceb12b8664f28ee956251fb516b7665041d57b112314
- MD5 67c20169c8da3ab61c3e007a517926a7
- SHA1 07ccc3da5d34823bd60be51432850200e0b37df6
- SHA512 c5897fb41708a2cbdaf86d09cbc826cf3d330555e95da4c5f83ca66bcff074f0c684a194c0c1664dde103bdb4c43498e57520d45fcc6f067bd72c427f7fba4f6
- SSDEEP 12288:gj8fuxR21t5i8fTjX8Da2guBF7zyqYNZ6:gj8fuK1GYTj8DDF7zyqYNI
- TLSH T1B6B4F0027849C032E99315315B66CBB51BBEBD355B3694C73BC436ADAFB52C2963830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2300 D9EB.tmp 5880 DA87.tmp 4032 DAF5.tmp 3836 DBDF.tmp 5260 DC8B.tmp 2264 DD37.tmp 956 DDB4.tmp 2696 DE6F.tmp 1136 DF79.tmp 4472 E073.tmp 5616 E10F.tmp 3892 E1FA.tmp 4632 E296.tmp 548 E361.tmp 4196 E41D.tmp 3716 E4C8.tmp 4908 E555.tmp 2380 E63F.tmp 1648 E6FB.tmp 5412 E7B6.tmp 1996 E843.tmp 3720 E8B0.tmp 6112 E98B.tmp 1356 E9F9.tmp 3012 EA76.tmp 1528 EB12.tmp 4828 EBAE.tmp 5804 EC6A.tmp 3944 ED35.tmp 4140 EDD1.tmp 4604 EE4E.tmp 4648 EEFA.tmp 4420 EF96.tmp 5252 F003.tmp 5904 F080.tmp 4564 F0FD.tmp 5256 F17A.tmp 5928 F207.tmp 5588 F2A3.tmp 3604 F34F.tmp 4528 F3CC.tmp 4940 F43A.tmp 1400 F4A7.tmp 2040 F524.tmp 712 F5B1.tmp 2100 F62E.tmp 4368 F6BA.tmp 1764 F728.tmp 2440 F795.tmp 1376 F831.tmp 4500 F8BE.tmp 4004 F93B.tmp 4340 F9C7.tmp 416 FA44.tmp 4480 FAC1.tmp 3664 FB4E.tmp 1704 FBCB.tmp 4728 FC58.tmp 4084 FCD5.tmp 5864 FD81.tmp 3332 FE0D.tmp 2160 FE8A.tmp 4124 FF07.tmp 3228 FF75.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5792.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F17A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4131.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 178C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2670.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3228.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7490.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBCB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 125.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5408.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F207.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 736C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7684.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 370F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D13C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C8B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F524.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6042.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C593.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1946.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F723.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A63F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2665.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 925E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 312E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4864.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A624.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF96.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3024 wrote to memory of 2300 3024 2026-10-01_67c20169c8da3ab61c3e007a517926a7_elex_mafia.exe 87 PID 2300 wrote to memory of 5880 2300 D9EB.tmp 89 PID 5880 wrote to memory of 4032 5880 DA87.tmp 90 PID 4032 wrote to memory of 3836 4032 DAF5.tmp 91 PID 3836 wrote to memory of 5260 3836 DBDF.tmp 92 PID 5260 wrote to memory of 2264 5260 DC8B.tmp 93 PID 2264 wrote to memory of 956 2264 DD37.tmp 94 PID 956 wrote to memory of 2696 956 DDB4.tmp 95 PID 2696 wrote to memory of 1136 2696 DE6F.tmp 96 PID 1136 wrote to memory of 4472 1136 DF79.tmp 97 PID 4472 wrote to memory of 5616 4472 E073.tmp 98 PID 5616 wrote to memory of 3892 5616 E10F.tmp 99 PID 3892 wrote to memory of 4632 3892 E1FA.tmp 100 PID 4632 wrote to memory of 548 4632 E296.tmp 101 PID 548 wrote to memory of 4196 548 E361.tmp 102 PID 4196 wrote to memory of 3716 4196 E41D.tmp 103 PID 3716 wrote to memory of 4908 3716 E4C8.tmp 104 PID 4908 wrote to memory of 2380 4908 E555.tmp 105 PID 2380 wrote to memory of 1648 2380 E63F.tmp 106 PID 1648 wrote to memory of 5412 1648 E6FB.tmp 107 PID 5412 wrote to memory of 1996 5412 E7B6.tmp 108 PID 1996 wrote to memory of 3720 1996 E843.tmp 109 PID 3720 wrote to memory of 6112 3720 E8B0.tmp 110 PID 6112 wrote to memory of 1356 6112 E98B.tmp 111 PID 1356 wrote to memory of 3012 1356 E9F9.tmp 112 PID 3012 wrote to memory of 1528 3012 EA76.tmp 113 PID 1528 wrote to memory of 4828 1528 EB12.tmp 114 PID 4828 wrote to memory of 5804 4828 EBAE.tmp 115 PID 5804 wrote to memory of 3944 5804 EC6A.tmp 116 PID 3944 wrote to memory of 4140 3944 ED35.tmp 117 PID 4140 wrote to memory of 4604 4140 EDD1.tmp 118 PID 4604 wrote to memory of 4648 4604 EE4E.tmp 119 PID 4648 wrote to memory of 4420 4648 EEFA.tmp 120 PID 4420 wrote to memory of 5252 4420 EF96.tmp 121 PID 5252 wrote to memory of 5904 5252 F003.tmp 122 PID 5904 wrote to memory of 4564 5904 F080.tmp 123 PID 4564 wrote to memory of 5256 4564 F0FD.tmp 124 PID 5256 wrote to memory of 5928 5256 F17A.tmp 125 PID 5928 wrote to memory of 5588 5928 F207.tmp 126 PID 5588 wrote to memory of 3604 5588 F2A3.tmp 127 PID 3604 wrote to memory of 4528 3604 F34F.tmp 128 PID 4528 wrote to memory of 4940 4528 F3CC.tmp 129 PID 4940 wrote to memory of 1400 4940 F43A.tmp 130 PID 1400 wrote to memory of 2040 1400 F4A7.tmp 131 PID 2040 wrote to memory of 712 2040 F524.tmp 132 PID 712 wrote to memory of 2100 712 F5B1.tmp 133 PID 2100 wrote to memory of 4368 2100 F62E.tmp 134 PID 4368 wrote to memory of 1764 4368 F6BA.tmp 135 PID 1764 wrote to memory of 2440 1764 F728.tmp 136 PID 2440 wrote to memory of 1376 2440 F795.tmp 137 PID 1376 wrote to memory of 4500 1376 F831.tmp 138 PID 4500 wrote to memory of 4004 4500 F8BE.tmp 139 PID 4004 wrote to memory of 4340 4004 F93B.tmp 140 PID 4340 wrote to memory of 416 4340 F9C7.tmp 141 PID 416 wrote to memory of 4480 416 FA44.tmp 142 PID 4480 wrote to memory of 3664 4480 FAC1.tmp 143 PID 3664 wrote to memory of 1704 3664 FB4E.tmp 144 PID 1704 wrote to memory of 4728 1704 FBCB.tmp 145 PID 4728 wrote to memory of 4084 4728 FC58.tmp 146 PID 4084 wrote to memory of 5864 4084 FCD5.tmp 147 PID 5864 wrote to memory of 3332 5864 FD81.tmp 148 PID 3332 wrote to memory of 2160 3332 FE0D.tmp 149 PID 2160 wrote to memory of 4124 2160 FE8A.tmp 150 PID 4124 wrote to memory of 3228 4124 FF07.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_67c20169c8da3ab61c3e007a517926a7_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_67c20169c8da3ab61c3e007a517926a7_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\D9EB.tmp"C:\Users\Admin\AppData\Local\Temp\D9EB.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\DA87.tmp"C:\Users\Admin\AppData\Local\Temp\DA87.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Users\Admin\AppData\Local\Temp\DAF5.tmp"C:\Users\Admin\AppData\Local\Temp\DAF5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\DBDF.tmp"C:\Users\Admin\AppData\Local\Temp\DBDF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\DC8B.tmp"C:\Users\Admin\AppData\Local\Temp\DC8B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\Users\Admin\AppData\Local\Temp\DD37.tmp"C:\Users\Admin\AppData\Local\Temp\DD37.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\DDB4.tmp"C:\Users\Admin\AppData\Local\Temp\DDB4.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\DE6F.tmp"C:\Users\Admin\AppData\Local\Temp\DE6F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\DF79.tmp"C:\Users\Admin\AppData\Local\Temp\DF79.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\E073.tmp"C:\Users\Admin\AppData\Local\Temp\E073.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\E10F.tmp"C:\Users\Admin\AppData\Local\Temp\E10F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Users\Admin\AppData\Local\Temp\E1FA.tmp"C:\Users\Admin\AppData\Local\Temp\E1FA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\E296.tmp"C:\Users\Admin\AppData\Local\Temp\E296.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\E361.tmp"C:\Users\Admin\AppData\Local\Temp\E361.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\E41D.tmp"C:\Users\Admin\AppData\Local\Temp\E41D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\E4C8.tmp"C:\Users\Admin\AppData\Local\Temp\E4C8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\E555.tmp"C:\Users\Admin\AppData\Local\Temp\E555.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\E63F.tmp"C:\Users\Admin\AppData\Local\Temp\E63F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\E6FB.tmp"C:\Users\Admin\AppData\Local\Temp\E6FB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\E7B6.tmp"C:\Users\Admin\AppData\Local\Temp\E7B6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Users\Admin\AppData\Local\Temp\E843.tmp"C:\Users\Admin\AppData\Local\Temp\E843.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\E8B0.tmp"C:\Users\Admin\AppData\Local\Temp\E8B0.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\E98B.tmp"C:\Users\Admin\AppData\Local\Temp\E98B.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6112 -
C:\Users\Admin\AppData\Local\Temp\E9F9.tmp"C:\Users\Admin\AppData\Local\Temp\E9F9.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\EA76.tmp"C:\Users\Admin\AppData\Local\Temp\EA76.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\EB12.tmp"C:\Users\Admin\AppData\Local\Temp\EB12.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\EBAE.tmp"C:\Users\Admin\AppData\Local\Temp\EBAE.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\EC6A.tmp"C:\Users\Admin\AppData\Local\Temp\EC6A.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Users\Admin\AppData\Local\Temp\ED35.tmp"C:\Users\Admin\AppData\Local\Temp\ED35.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\EDD1.tmp"C:\Users\Admin\AppData\Local\Temp\EDD1.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\EE4E.tmp"C:\Users\Admin\AppData\Local\Temp\EE4E.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\EEFA.tmp"C:\Users\Admin\AppData\Local\Temp\EEFA.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\EF96.tmp"C:\Users\Admin\AppData\Local\Temp\EF96.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\F003.tmp"C:\Users\Admin\AppData\Local\Temp\F003.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Users\Admin\AppData\Local\Temp\F080.tmp"C:\Users\Admin\AppData\Local\Temp\F080.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Users\Admin\AppData\Local\Temp\F0FD.tmp"C:\Users\Admin\AppData\Local\Temp\F0FD.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\F17A.tmp"C:\Users\Admin\AppData\Local\Temp\F17A.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\Users\Admin\AppData\Local\Temp\F207.tmp"C:\Users\Admin\AppData\Local\Temp\F207.tmp"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Users\Admin\AppData\Local\Temp\F2A3.tmp"C:\Users\Admin\AppData\Local\Temp\F2A3.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Users\Admin\AppData\Local\Temp\F34F.tmp"C:\Users\Admin\AppData\Local\Temp\F34F.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\F3CC.tmp"C:\Users\Admin\AppData\Local\Temp\F3CC.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\F43A.tmp"C:\Users\Admin\AppData\Local\Temp\F43A.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\F4A7.tmp"C:\Users\Admin\AppData\Local\Temp\F4A7.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\F524.tmp"C:\Users\Admin\AppData\Local\Temp\F524.tmp"45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\F5B1.tmp"C:\Users\Admin\AppData\Local\Temp\F5B1.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Users\Admin\AppData\Local\Temp\F62E.tmp"C:\Users\Admin\AppData\Local\Temp\F62E.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\F6BA.tmp"C:\Users\Admin\AppData\Local\Temp\F6BA.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\F728.tmp"C:\Users\Admin\AppData\Local\Temp\F728.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\F795.tmp"C:\Users\Admin\AppData\Local\Temp\F795.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\F831.tmp"C:\Users\Admin\AppData\Local\Temp\F831.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\F8BE.tmp"C:\Users\Admin\AppData\Local\Temp\F8BE.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\F93B.tmp"C:\Users\Admin\AppData\Local\Temp\F93B.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\F9C7.tmp"C:\Users\Admin\AppData\Local\Temp\F9C7.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\FA44.tmp"C:\Users\Admin\AppData\Local\Temp\FA44.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Users\Admin\AppData\Local\Temp\FAC1.tmp"C:\Users\Admin\AppData\Local\Temp\FAC1.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\FB4E.tmp"C:\Users\Admin\AppData\Local\Temp\FB4E.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\FBCB.tmp"C:\Users\Admin\AppData\Local\Temp\FBCB.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\FC58.tmp"C:\Users\Admin\AppData\Local\Temp\FC58.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\FCD5.tmp"C:\Users\Admin\AppData\Local\Temp\FCD5.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\FD81.tmp"C:\Users\Admin\AppData\Local\Temp\FD81.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Users\Admin\AppData\Local\Temp\FE0D.tmp"C:\Users\Admin\AppData\Local\Temp\FE0D.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\FE8A.tmp"C:\Users\Admin\AppData\Local\Temp\FE8A.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\FF07.tmp"C:\Users\Admin\AppData\Local\Temp\FF07.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\FF75.tmp"C:\Users\Admin\AppData\Local\Temp\FF75.tmp"65⤵
- Executes dropped EXE
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\1.tmp"C:\Users\Admin\AppData\Local\Temp\1.tmp"66⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\9D.tmp"C:\Users\Admin\AppData\Local\Temp\9D.tmp"67⤵PID:5348
-
C:\Users\Admin\AppData\Local\Temp\12A.tmp"C:\Users\Admin\AppData\Local\Temp\12A.tmp"68⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\1B7.tmp"C:\Users\Admin\AppData\Local\Temp\1B7.tmp"69⤵PID:428
-
C:\Users\Admin\AppData\Local\Temp\263.tmp"C:\Users\Admin\AppData\Local\Temp\263.tmp"70⤵PID:120
-
C:\Users\Admin\AppData\Local\Temp\2EF.tmp"C:\Users\Admin\AppData\Local\Temp\2EF.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\36C.tmp"C:\Users\Admin\AppData\Local\Temp\36C.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:5472 -
C:\Users\Admin\AppData\Local\Temp\3E9.tmp"C:\Users\Admin\AppData\Local\Temp\3E9.tmp"73⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\466.tmp"C:\Users\Admin\AppData\Local\Temp\466.tmp"74⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\4D4.tmp"C:\Users\Admin\AppData\Local\Temp\4D4.tmp"75⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\560.tmp"C:\Users\Admin\AppData\Local\Temp\560.tmp"76⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\5ED.tmp"C:\Users\Admin\AppData\Local\Temp\5ED.tmp"77⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\65A.tmp"C:\Users\Admin\AppData\Local\Temp\65A.tmp"78⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\6F6.tmp"C:\Users\Admin\AppData\Local\Temp\6F6.tmp"79⤵PID:5960
-
C:\Users\Admin\AppData\Local\Temp\7A2.tmp"C:\Users\Admin\AppData\Local\Temp\7A2.tmp"80⤵PID:5600
-
C:\Users\Admin\AppData\Local\Temp\810.tmp"C:\Users\Admin\AppData\Local\Temp\810.tmp"81⤵PID:5820
-
C:\Users\Admin\AppData\Local\Temp\88D.tmp"C:\Users\Admin\AppData\Local\Temp\88D.tmp"82⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\948.tmp"C:\Users\Admin\AppData\Local\Temp\948.tmp"83⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\9B6.tmp"C:\Users\Admin\AppData\Local\Temp\9B6.tmp"84⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\A52.tmp"C:\Users\Admin\AppData\Local\Temp\A52.tmp"85⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\ACF.tmp"C:\Users\Admin\AppData\Local\Temp\ACF.tmp"86⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\B4C.tmp"C:\Users\Admin\AppData\Local\Temp\B4C.tmp"87⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\BE8.tmp"C:\Users\Admin\AppData\Local\Temp\BE8.tmp"88⤵PID:5512
-
C:\Users\Admin\AppData\Local\Temp\C75.tmp"C:\Users\Admin\AppData\Local\Temp\C75.tmp"89⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\CE2.tmp"C:\Users\Admin\AppData\Local\Temp\CE2.tmp"90⤵PID:5680
-
C:\Users\Admin\AppData\Local\Temp\D5F.tmp"C:\Users\Admin\AppData\Local\Temp\D5F.tmp"91⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\DFB.tmp"C:\Users\Admin\AppData\Local\Temp\DFB.tmp"92⤵PID:5860
-
C:\Users\Admin\AppData\Local\Temp\E88.tmp"C:\Users\Admin\AppData\Local\Temp\E88.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\F15.tmp"C:\Users\Admin\AppData\Local\Temp\F15.tmp"94⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\F92.tmp"C:\Users\Admin\AppData\Local\Temp\F92.tmp"95⤵PID:5700
-
C:\Users\Admin\AppData\Local\Temp\101E.tmp"C:\Users\Admin\AppData\Local\Temp\101E.tmp"96⤵PID:5644
-
C:\Users\Admin\AppData\Local\Temp\108C.tmp"C:\Users\Admin\AppData\Local\Temp\108C.tmp"97⤵PID:5400
-
C:\Users\Admin\AppData\Local\Temp\1128.tmp"C:\Users\Admin\AppData\Local\Temp\1128.tmp"98⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\11A5.tmp"C:\Users\Admin\AppData\Local\Temp\11A5.tmp"99⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\1212.tmp"C:\Users\Admin\AppData\Local\Temp\1212.tmp"100⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\1280.tmp"C:\Users\Admin\AppData\Local\Temp\1280.tmp"101⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\12FD.tmp"C:\Users\Admin\AppData\Local\Temp\12FD.tmp"102⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\137A.tmp"C:\Users\Admin\AppData\Local\Temp\137A.tmp"103⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\13F7.tmp"C:\Users\Admin\AppData\Local\Temp\13F7.tmp"104⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\1464.tmp"C:\Users\Admin\AppData\Local\Temp\1464.tmp"105⤵PID:5548
-
C:\Users\Admin\AppData\Local\Temp\14F1.tmp"C:\Users\Admin\AppData\Local\Temp\14F1.tmp"106⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\156E.tmp"C:\Users\Admin\AppData\Local\Temp\156E.tmp"107⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\15FA.tmp"C:\Users\Admin\AppData\Local\Temp\15FA.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\1687.tmp"C:\Users\Admin\AppData\Local\Temp\1687.tmp"109⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\1723.tmp"C:\Users\Admin\AppData\Local\Temp\1723.tmp"110⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\1790.tmp"C:\Users\Admin\AppData\Local\Temp\1790.tmp"111⤵PID:6136
-
C:\Users\Admin\AppData\Local\Temp\180D.tmp"C:\Users\Admin\AppData\Local\Temp\180D.tmp"112⤵PID:5888
-
C:\Users\Admin\AppData\Local\Temp\189A.tmp"C:\Users\Admin\AppData\Local\Temp\189A.tmp"113⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\1946.tmp"C:\Users\Admin\AppData\Local\Temp\1946.tmp"114⤵
- System Location Discovery: System Language Discovery
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\19D3.tmp"C:\Users\Admin\AppData\Local\Temp\19D3.tmp"115⤵
- System Location Discovery: System Language Discovery
PID:200 -
C:\Users\Admin\AppData\Local\Temp\1A50.tmp"C:\Users\Admin\AppData\Local\Temp\1A50.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\1AFB.tmp"C:\Users\Admin\AppData\Local\Temp\1AFB.tmp"117⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\1B78.tmp"C:\Users\Admin\AppData\Local\Temp\1B78.tmp"118⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\1C15.tmp"C:\Users\Admin\AppData\Local\Temp\1C15.tmp"119⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\1CB1.tmp"C:\Users\Admin\AppData\Local\Temp\1CB1.tmp"120⤵PID:5728
-
C:\Users\Admin\AppData\Local\Temp\1D1E.tmp"C:\Users\Admin\AppData\Local\Temp\1D1E.tmp"121⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\1D9B.tmp"C:\Users\Admin\AppData\Local\Temp\1D9B.tmp"122⤵PID:2796
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-